spring security session registry empty

Question

I have a spring mvc webapp using spring security and one thing I would like to do every time a user logs in is log the number of concurrent users on the system.

To do this I have given my session registry an alias and then I autowire into a class and say...

List<Object> principals = sessionRegistry.getAllPrincipals();
MDC.put(MDCKeyConstants.CONCURRENT_USER_COUNT, principals.size());

but principals.size is coming to 0 . i.e. the principals list is empty. Am I missing something else that I need to configure?

Sorry for the long post but I'm putting my spring security config here to try and get some help with the issue.. thanks in advance...

<http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">    
    <!-- custom filters -->
    <custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" />      
    <custom-filter after="SECURITY_CONTEXT_FILTER" ref="securityLoggingFilter"/>

    <!-- session management -->     
    <session-management 
        invalid-session-url="/sessionExpired.htm" 
        session-authentication-error-url="/alreadyLoggedIn.htm">

        <concurrency-control 
            max-sessions="1" 
            expired-url="/sessionExpiredDuplicateLogin.htm" 
            error-if-maximum-exceeded="false" 
            session-registry-alias="sessionRegistry"/>

    </session-management>   

    <!-- error handlers -->
    <access-denied-handler error-page="/accessDenied.htm"/>             

    <!-- logout --> 
    <logout logout-success-url="/logout.htm" invalidate-session="false" delete-cookies="JSESSIONID"/>   

    <!-- authorize pages -->    
    <intercept-url pattern="/home.htm" access="isAuthenticated()" />
    <intercept-url pattern="/shortsAndOvers.htm" access="isAuthenticated()" />
    <intercept-url pattern="/shortsAndOversDaily.htm" access="isAuthenticated()" />
    <intercept-url pattern="/birtpage.htm" access="isAuthenticated()" />
    <intercept-url pattern="/reports/show.htm" access="isAuthenticated()" />    

</http> 

<!-- =============================== -->
<!--      AUTHENTICATION BEANS       -->
<!-- =============================== -->

<beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
  <beans:property name="userDetailsService" ref="userDetailsDao" />
  <beans:property name="passwordEncoder" ref="encoder" />
</beans:bean>

<beans:bean id="twoFactorAuthenticationFilter" class="com.mycompany.reporting.security.TwoFactorAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="authenticationFailureHandler" ref="failureHandler" />
    <beans:property name="authenticationSuccessHandler" ref="successHandler" />        
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
    <beans:property name="postOnly" value="true" />
</beans:bean>

<beans:bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/login.htm" />
</beans:bean>

<beans:bean id="successHandler" class="com.mycompany.reporting.security.CustomSavedRequestAwareAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" value="/home.htm" />
</beans:bean>

<beans:bean id="failureHandler" class="com.mycompany.reporting.security.CustomSimpleUrlAuthenticationFailureHandler">
    <beans:property name="defaultFailureUrl" value="/loginfailed.htm" />
</beans:bean>                          

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="authenticationProvider"></authentication-provider>
</authentication-manager>

Answer 1

Try this. It has worked for me.

in <http></http>,

<session-management session-authentication-strategy-ref="sas" invalid-session-url="/invalid-session" />

And declare beans as follows:

<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

<beans:bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"> <beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" /> <beans:property name="maximumSessions" value="1" /> </beans:bean>

And do not forget to add org.springframework.security.web.session.HttpSessionEventPublisher listener to your web configuration.